1. Field
Invention relates generally to computer systems, and in particular to controlling the use of computing resources by controlling language interfaces.
2. Related Art
Most information processing systems comprise hardware and software components with well-known interfaces, wherein the interfaces facilitate the use of the system components by other components specifically developed to use the interfaces. A common goal in practical computing comprises limiting the use of a specific system to software that the owners or operators of the system wish to use, disallowing the execution of arbitrary pieces of software on the system and the use of system resources by such arbitrary software, even if such software has been developed to use the interfaces provided by the system. However, this goal is difficult to achieve because of the impracticality of controlling the set of software that can attempt to execute on a given system. Furthermore, since the interfaces of most systems are well known, software with an opportunity to attempt execution or system usage will frequently succeed.
There are current techniques for limiting a given computing system such that only a specific set of software can execute on the system. Current techniques fall into the following categories: techniques for randomizing instruction sets; virtualization or mapping techniques; software encryption; and techniques for containing the use, of functional interfaces and similar request-response interfaces including messaging interfaces. Encryption-based techniques rely on shared secrets used for cryptographic pre-execution checks, and fail to limit system usage once the pre-execution check succeeds. Randomized instruction set techniques generally rely on secret sharing schemes applied to functional interfaces, by using random secret data to transform a program's use of an interface's function names, keywords, instructions, command names, etc. Neither encryption or randomization has been used for programs that when executed compute or obtain new commands to execute. Virtualization avoids dependence on shared secrets but has been applied only to create variant name spaces for a fixed set of names of existing system resources such as memory addresses, file names, instruction operation codes, etc.
Accordingly, there is a need for a technique that is not based on validation checks, not limited by shared secrets, not limited to finite name space, and that applies to any linguistic representation and at all times, including cases where the running software computes or obtains new commands to execute.